auth

Documentation

Index

• type Processor
  • func NewProcessor(s secrets.Secrets, trustedCertificate *x509.Certificate) *Processor
  • func (p *Processor) AddOrUpdateService(apis *urisearch.APICache, serviceType policy.UserAuthorizationTypeValues, ...)
  • func (p *Processor) Callback(w http.ResponseWriter, r *http.Request)
  • func (p *Processor) Check(method, uri string, claims []string) (bool, bool)
  • func (p *Processor) DecodeAporetoClaims(aporetoToken string, publicKey string) (string, []string)
  • func (p *Processor) DecodeUserClaims(name, userToken string, certs []*x509.Certificate, r *http.Request) ([]string, bool, string, error)
  • func (p *Processor) RedirectURI(originURL string) string
  • func (p *Processor) RetrieveServiceHandler() (usertokens.Verifier, error)
  • func (p *Processor) UpdateRequestHeaders(r *http.Request, claims []string)
  • func (p *Processor) UpdateSecrets(s secrets.Secrets, trustedCertificate *x509.Certificate)
  • func (p *Processor) UpdateServiceAPIs(apis *urisearch.APICache) error

Types

type Processor

type Processor struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

Processor holds all the local data of the authorization engine. A processor can handle authorization for multiple services. The goal is to authenticate a request based on both service and user credentials.

func NewProcessor

func NewProcessor(s secrets.Secrets, trustedCertificate *x509.Certificate) *Processor

NewProcessor creates an auth processor with PKI user tokens. The caller must provide a valid secrets structure and an optional list of trustedCertificates that can be used to validate tokens. If the list is empty, the CA from the secrets will be used for token validation.

func (*Processor) AddOrUpdateService

func (p *Processor) AddOrUpdateService(apis *urisearch.APICache, serviceType policy.UserAuthorizationTypeValues, handler usertokens.Verifier, mappings map[string]string)

AddOrUpdateService adds or replaces a service in the authorization db.

func (*Processor) Callback

func (p *Processor) Callback(w http.ResponseWriter, r *http.Request)

Callback is function called by and IDP auth provider will exchange the provided authorization code with a JWT token. This closes the Oauth loop.

func (*Processor) Check

func (p *Processor) Check(method, uri string, claims []string) (bool, bool)

Check is the main method that will search API cache and validate whether the call should be allowed. It returns two values. If the access is allowed, and whether the access public or not. This allows callers to decide what to do when there is a failure, and potentially issue a redirect.

func (*Processor) DecodeAporetoClaims

func (p *Processor) DecodeAporetoClaims(aporetoToken string, publicKey string) (string, []string)

DecodeAporetoClaims decodes the Aporeto claims

func (*Processor) DecodeUserClaims

func (p *Processor) DecodeUserClaims(name, userToken string, certs []*x509.Certificate, r *http.Request) ([]string, bool, string, error)

DecodeUserClaims decodes the user claims with the user authorization method.

func (*Processor) RedirectURI

func (p *Processor) RedirectURI(originURL string) string

RedirectURI returns the redirect URI in order to start the authentication dance.

func (*Processor) RetrieveServiceHandler

func (p *Processor) RetrieveServiceHandler() (usertokens.Verifier, error)

RetrieveServiceHandler will retrieve the service that is stored in the serviceMap

func (*Processor) UpdateRequestHeaders

func (p *Processor) UpdateRequestHeaders(r *http.Request, claims []string)

UpdateRequestHeaders will update the request headers based on the user claims and the corresponding mappings.

func (*Processor) UpdateSecrets

func (p *Processor) UpdateSecrets(s secrets.Secrets, trustedCertificate *x509.Certificate)

UpdateSecrets will update the Aporeto secrets for the validation of the Aporeto tokens.

func (*Processor) UpdateServiceAPIs

func (p *Processor) UpdateServiceAPIs(apis *urisearch.APICache) error

UpdateServiceAPIs updates an existing service with a new API definition.